Practice Management Alert

Don't sweep a revised Notice of Privacy Practices under the rug - show it off

HIPAA mandates that you provide all patients with an NPP, but you're not necessarily finished once you've handed out that initial form.

If you decide to make changes to your policy to better reflect your privacy practices in the office, what's next? Check out this expert HIPAA Q&A:

Question: We have revised our notice of privacy practices (NPP). Do our patients need to sign it again? What is the best way to distribute the new notice?

Answer: "You do not have to resend the notice of privacy practices to your patients," says Brian Gradle, an attorney with Hogan & Hartson in Washington, D.C. But the next time patients return to your office, you should ask them to sign the revised notice, thereby acknowledging that you apprised them of the changes, he says.

Remember: As with the original NPP, your patients do not have to provide their signatures. But, you do have to document that you made a good-faith effort to obtain their written acknowledgement that they received the notice. Without documentation, you cannot prove that patients are aware of your modifications.

The Bottom Line: While you don't have to mail the revised notice, you do have to post it in a public area where it's reasonable to assume most patients will see it. For physician offices, HIPAA experts recommend that you post your NPP in the main waiting area. Also, you must "make [the notice] available upon patient request, post it on your Web site and have copies of it for patients to take away with them" if they want, Gradle says. If your practice has a Web site, you must make your most current NPP available online.